diff --git a/web/public/js/components/server/http-firewall-rule-label.js b/web/public/js/components/server/http-firewall-rule-label.js
index ae1f2bcf..55e27d45 100644
--- a/web/public/js/components/server/http-firewall-rule-label.js
+++ b/web/public/js/components/server/http-firewall-rule-label.js
@@ -8,7 +8,6 @@ Vue.component("http-firewall-rule-label", {
 	},
 	methods: {
 		showErr: function (err) {
-
 			teaweb.popupTip("规则校验错误，请修正：<span class=\"red\">"  + teaweb.encodeHTML(err) + "</span>")
 		},
 
@@ -24,7 +23,8 @@ Vue.component("http-firewall-rule-label", {
 
 		<!-- refererBlock -->
 		<span v-if="rule.param == '\${refererBlock}'">
-			{{rule.checkpointOptions.allowDomains}}
+			<span v-if="rule.checkpointOptions.allowDomains != null && rule.checkpointOptions.allowDomains.length > 0">允许{{rule.checkpointOptions.allowDomains}}</span>
+			<span v-if="rule.checkpointOptions.denyDomains != null && rule.checkpointOptions.denyDomains.length > 0">禁止{{rule.checkpointOptions.denyDomains}}</span>
 		</span>
 
 		<span v-else>
diff --git a/web/public/js/components/server/http-firewall-rules-box.js b/web/public/js/components/server/http-firewall-rules-box.js
index e1d3d77a..824b540d 100644
--- a/web/public/js/components/server/http-firewall-rules-box.js
+++ b/web/public/js/components/server/http-firewall-rules-box.js
@@ -48,7 +48,8 @@ Vue.component("http-firewall-rules-box", {
 				
 				<!-- refererBlock -->
 				<span v-if="rule.param == '\${refererBlock}'">
-					{{rule.checkpointOptions.allowDomains}}
+					<span v-if="rule.checkpointOptions.allowDomains != null && rule.checkpointOptions.allowDomains.length > 0">允许{{rule.checkpointOptions.allowDomains}}</span>
+					<span v-if="rule.checkpointOptions.denyDomains != null && rule.checkpointOptions.denyDomains.length > 0">禁止{{rule.checkpointOptions.denyDomains}}</span>
 				</span>
 				
 				<span v-else>
diff --git a/web/public/js/components/server/http-firewall-rules.js b/web/public/js/components/server/http-firewall-rules.js
index a1d39531..13eb7708 100644
--- a/web/public/js/components/server/http-firewall-rules.js
+++ b/web/public/js/components/server/http-firewall-rules.js
@@ -236,6 +236,7 @@ Vue.component("http-firewall-checkpoint-referer-block", {
 		let allowEmpty = true
 		let allowSameDomain = true
 		let allowDomains = []
+		let denyDomains = []
 
 		let options = {}
 		if (window.parent.UPDATING_RULE != null) {
@@ -254,6 +255,9 @@ Vue.component("http-firewall-checkpoint-referer-block", {
 		if (options.allowDomains != null && typeof (options.allowDomains) == "object") {
 			allowDomains = options.allowDomains
 		}
+		if (options.denyDomains != null && typeof (options.denyDomains) == "object") {
+			denyDomains = options.denyDomains
+		}
 
 		let that = this
 		setTimeout(function () {
@@ -264,6 +268,7 @@ Vue.component("http-firewall-checkpoint-referer-block", {
 			allowEmpty: allowEmpty,
 			allowSameDomain: allowSameDomain,
 			allowDomains: allowDomains,
+			denyDomains: denyDomains,
 			options: {},
 			value: 0
 		}
@@ -281,6 +286,10 @@ Vue.component("http-firewall-checkpoint-referer-block", {
 			this.allowDomains = values
 			this.change()
 		},
+		changeDenyDomains: function (values) {
+			this.denyDomains = values
+			this.change()
+		},
 		change: function () {
 			this.vCheckpoint.options = [
 				{
@@ -294,7 +303,11 @@ Vue.component("http-firewall-checkpoint-referer-block", {
 				{
 					code: "allowDomains",
 					value: this.allowDomains
-				}
+				},
+				{
+					code: "denyDomains",
+					value: this.denyDomains
+				},
 			]
 		}
 	},
@@ -323,6 +336,13 @@ Vue.component("http-firewall-checkpoint-referer-block", {
 				<p class="comment">允许的来源域名列表，比如<code-label>example.com</code-label>、<code-label>*.example.com</code-label>。单个星号<code-label>*</code-label>表示允许所有域名。</p>
 			</td>
 		</tr>
+		<tr>
+			<td>禁止的来源域名</td>
+			<td>
+				<values-box :values="denyDomains" @change="changeDenyDomains"></values-box>
+				<p class="comment">禁止的来源域名列表，比如<code-label>example.org</code-label>、<code-label>*.example.org</code-label>；除了这些禁止的来源域名外，其他域名都会被允许，除非限定了允许的来源域名。</p>
+			</td>
+		</tr>
 	</table>
 </div>`
 })
\ No newline at end of file
diff --git a/web/public/js/components/server/http-referers-config-box.js b/web/public/js/components/server/http-referers-config-box.js
index ffb273bf..f7cf2433 100644
--- a/web/public/js/components/server/http-referers-config-box.js
+++ b/web/public/js/components/server/http-referers-config-box.js
@@ -8,12 +8,16 @@ Vue.component("http-referers-config-box", {
 				isOn: false,
 				allowEmpty: true,
 				allowSameDomain: true,
-				allowDomains: []
+				allowDomains: [],
+				denyDomains: []
 			}
 		}
 		if (config.allowDomains == null) {
 			config.allowDomains = []
 		}
+		if (config.denyDomains == null) {
+			config.denyDomains = []
+		}
 		return {
 			config: config
 		}
@@ -23,6 +27,8 @@ Vue.component("http-referers-config-box", {
 			return ((!this.vIsLocation && !this.vIsGroup) || this.config.isPrior) && this.config.isOn
 		},
 		changeAllowDomains: function (domains) {
+		},
+		changeDenyDomains: function (domains) {
 		}
 	},
 	template: `<div>
@@ -63,6 +69,13 @@ Vue.component("http-referers-config-box", {
 				<p class="comment">允许的其他来源域名列表，比如<code-label>example.com</code-label>、<code-label>*.example.com</code-label>。单个星号<code-label>*</code-label>表示允许所有域名。</p>
 			</td>
 		</tr>
+		<tr>
+			<td>禁止的来源域名</td>
+			<td>
+				<values-box :values="config.denyDomains" @change="changeDenyDomains"></values-box>
+				<p class="comment">禁止的来源域名列表，比如<code-label>example.org</code-label>、<code-label>*.example.org</code-label>；除了这些禁止的来源域名外，其他域名都会被允许，除非限定了允许的来源域名。</p>
+			</td>
+		</tr>
 	</tbody>
 </table>
 <div class="ui margin"></div>
diff --git a/web/views/@default/servers/components/waf/createRulePopup.html b/web/views/@default/servers/components/waf/createRulePopup.html
index c3af26da..6bbd6e3e 100644
--- a/web/views/@default/servers/components/waf/createRulePopup.html
+++ b/web/views/@default/servers/components/waf/createRulePopup.html
@@ -42,10 +42,10 @@
                     <!-- 通用header -->
 					<http-cond-general-header-length v-if="checkpoint.prefix == 'requestGeneralHeaderLength' || checkpoint.prefix == 'responseGeneralHeaderLength'" :v-checkpoint="checkpoint"></http-cond-general-header-length>
 
-                    <!-- CC -->
+                    <!-- 防盗链 -->
                     <http-firewall-checkpoint-referer-block v-if="checkpoint.prefix == 'refererBlock'" :v-checkpoint="checkpoint"></http-firewall-checkpoint-referer-block>
 
-                    <!-- 防盗链 -->
+                    <!-- CC -->
                     <http-firewall-checkpoint-cc v-if="checkpoint.prefix == 'cc2'" :v-checkpoint="checkpoint"></http-firewall-checkpoint-cc>
 				</td>
 			</tr>
diff --git a/web/views/@default/users/index.html b/web/views/@default/users/index.html
index 55a98153..03f1380e 100644
--- a/web/views/@default/users/index.html
+++ b/web/views/@default/users/index.html
@@ -23,7 +23,7 @@
 </form>
 
 <p class="comment" v-if="users.length == 0">暂时还没有用户。</p>
-<table class="ui table selectable" v-if="users.length > 0">
+<table class="ui table selectable celled" v-if="users.length > 0">
 	<thead>
 		<tr>
 			<th>用户名</th>